Policy · Confidentiality & client information
AI data incident steps (confidentiality short form of the AI incident response procedure)
Confidentiality steps for AI incidents that expose information (public chatbots, wrong workspaces, vendor leaks, misdirecting agents, restricted court material, note-taker bots), with the privilege, privacy, court-order and barrier assessment. Runs inside the master procedure.
- Kind
- Policy. A policy or procedure for a firm or client.
- Where it applies
- Australia, New South Wales
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked on 17 October 2026 against the 6 authorities it cites, for Australia and New South Wales.
- Version
- 1
- Source
- Written for this library
When to use it
Use inside the master AI incident response procedure whenever an AI incident involves client, privileged, personal or restricted information, alongside the data breach response plan. It does not replace the Notifiable Data Breaches assessment or the master procedure's court-correction step.
How AI may be used
AI may help build an incident chronology in an approved tool and draft internal updates. The incident lead, the matter partner and the privacy officer decide containment, notification to clients, courts, insurers and the OAIC.
AI may
- In an approved tool, assemble a chronology of the incident from logs and emails, citing each source.
- Draft internal status updates and a lessons-learned report for review.
- Search the approved tools' audit logs for other uploads by the same user or of the same file.
AI must not
- Must not decide whether the incident is an eligible data breach, whether privilege is lost, or whether to tell a client or court.
- Must not draft communications to clients, courts, the OAIC or insurers except as a first draft for the partner to rewrite.
- Must not be the same tool that caused the incident, unless IT has cleared it.
The lawyer checks
- The vendor has confirmed deletion in writing, or the risk is recorded.
- Each affected client has been considered for notification, and the decision recorded.
- Any court order or practice note breach has been assessed and, where needed, raised with the court.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Confidentiality & client information
- AI confidentiality rules for staff (short form of the firm AI policy)
- Staff and contractor AI confidentiality undertaking and acknowledgement
- AI vendor confidentiality and privilege questions (short form of the vendor due-diligence questionnaire)
- Engagement clause: client authority for AI processing of confidential information (rider to the AI engagement clauses)
All precedents for Confidentiality & client information · Tasks and AI use in this area